We have purchased the license ... View more

There is a malicious website Eg: https://xxxx.xxxx.com I just wanted to find out if anybody tried to access the URLhttps://xxxx.xxxx.com  from my organization or any communication from the malicious URL https://xxxx.xxxx.com to our network. Firewall , Crowdstrike - are the available data ... View more

I can replace `summariesonly' by summariesonly=t , but all the scheduled alerts are not working.  Should I create new alerts with summariesonly=t  or any other solution to solve this issue ? ... View more

I need to exclude the computer account ends with $, with the above query I am getting the result including computer account $. Can anyone please help me with this search query? ... View more

Hi cyber_Maddy, Overuse of real-time search can result in performance costs and in this you are not able to scheduled a real-time alert because of restrictions that have applied in your environment Options for restricting real-time search are as follows: 1) Disable real-time search at the indexer level by editing indexes.conf for specific indexes. 2) Disable real-time search for particular roles and users. 3) Edit limits.conf to reduce the number of real-time searches that can be run concurrently at any given time. 4) Edit limits.conf to restrict indexer support for real-time searches. The documentation, How to restrict usage of real-time search is where you will want to go. https://docs.splunk.com/Documentation/Splunk/8.2.2/Search/Restrictrealtimesearch Also, make sure you're reading the documentation for your version of Splunk. ------ An upvote would be appreciated and Accept Solution if it helps! ... View more

You can use a search like this to create a dashboard for your homepage. index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity | rename trigger_time as "Alert Time" ss_name as "Alert Name" severity as "Severity" ... View more

Is there any app or any other options to show all the triggered alerts on the home page? I need all the alert needs to be displayed after login in to splunk. Can you please help me? ... View more